One agent. Every layer.
Most stacks bolt five products together and call it observability. Wakora is one agent, one console and one bill, from the disk you are about to fill to the person who picks up the phone at 4 a.m.
Find why checkout is slow, in five clicks.
A feature list tells you what we collect. What you actually buy is the thread between the layers: from a visitor's complaint down to the exact query, without changing tabs.
Real visitors report it
Checkout LCP p75 is 6.1 s for actual users. Not a synthetic guess: phones, in the wild.
The page carries its trace
A slow page view links to the exact backend request that produced it. One click, and you are in the waterfall.
The waterfall names the cost
One SELECT executed 216 times in a single request, query text included.
The N+1 card names the culprit
The pattern is detected automatically and attributed to the plugin and file that issued it.
The timeline explains when
A deploy marker two hours earlier shows when it started, and what shipped in that release.
Five clicks, zero log-diving. That is what full-stack means when the layers actually connect instead of living in five products.
Every host on one honest screen.
CPU, memory, disk, network, processes, listening ports, installed packages and pending updates, plus a year of availability rendered as one bar. When a host goes silent, detection takes about a minute, not a coffee break: the transport itself is the heartbeat.
- 365-day availability strip per host, incidents and maintenance marked inline
- Down detection in about a minute, because a dead WebSocket is a signal, not a timeout
- Hypervisor aware: Proxmox, KVM and Hyper-V guests with per-VM metrics
- Fleet control: agent versions pinned per host, canary rollout waves, one-click rollback
- Time travel: pin any moment and the whole console rewinds to it
It finds your services. Then it actually understands them.
Discovery is not a port scan with opinions. The agent reads the real config of each service it finds: nginx tells it where every vhost and log actually lives, MySQL reveals its socket and data directory, php-fpm its pools. Non-standard layouts are found, not assumed, and each service gets deep, purpose-built probes.
- Web: nginx and Apache with per-vhost latency, error rates and TLS expiry
- Data: MySQL, MariaDB, PostgreSQL, Redis, with the stats a DBA would ask for
- Mail and DNS: Postfix, Dovecot, Exim, bind, PowerDNS, queues and bounces included
- Ops reality: backup success, cron heartbeats, control panels, RabbitMQ, Kafka, NATS
- Presence-gated cards: a service card appears only when the service exists
The long tail is covered too.
A check in Wakora is a small declarative definition: match rules that say where it applies, probes that say what to measure. We maintain the core catalog. A marketplace of community definitions covers the software we have not met yet, and writing your own takes minutes, not an SDK.
Trust does not get outsourced: every definition is signed, community ones by their authors, and the console shows you the exact commands and queries a definition will run before its first run. Nothing executes without your approval, and anything it executes comes from an allow-list, never a raw shell.
- Signed by author, verified by the agent before running
- Preview before first run: see every command, approve or reject
- Declarative primitives: process, port, http, tcp, sql, file, exec
- Fleet-wide: publish once, every matching host picks it up
name: valkey match: process: valkey-server port: 6379 probes: - tcp: { port: 6379, send: "PING", expect: "+PONG" } - exec: { bin: /usr/bin/valkey-cli, args: [info, clients] } # signed: community/author · verified by agent # first run requires operator approval
From “the site is slow” to the guilty plugin.
Three depths, and you choose per site how deep to go. A zero-touch layer measures request rates, errors and latency percentiles without touching your services. Full tracing adds per-request waterfalls down to individual SQL queries. A sampling CPU profiler draws flamegraphs and names the exact plugin or theme burning your cores.
Activation respects production: the extension is staged, the console shows the exact reload command, and you run it in a window you choose. WordPress attribution is built in, N+1 patterns are detected automatically, and .NET services and IIS get the same treatment. Node.js and Next.js apps join through standard OpenTelemetry, whether they run under systemd, pm2 or Docker.
- RED metrics per endpoint: rate, errors, p50, p95, p99
- Traces with SQL: the same statement run 411 times in one request is flagged, with the query text
- CPU flamegraphs with per-plugin and per-theme attribution
- Deploy-aware: regressions are correlated with the deploy that caused them
- PHP 7.2 to 8.5 covered; deep traces on modern PHP, honest labels everywhere else
- Node.js and Next.js: OpenTelemetry tracing, staged activation, restarts stay in your hands
What your visitors actually felt.
Server-side numbers can be green while real users suffer on hotel wifi three countries away. A lightweight snippet reports Core Web Vitals, JavaScript errors and navigation timing from real sessions, broken down by country, device and page. On WordPress the snippet injects itself; everywhere else it is one script tag.
- Core Web Vitals: LCP, CLS, INP with honest percentiles
- JavaScript errors grouped, counted and tied to releases
- Audience view: geography, devices, browsers, entry pages
- Front-to-back correlation: a slow page links to its server traces
The outage your servers cannot feel.
A firewall rule eats port 443 and every internal check stays green while customers stare at a spinner. Wakora probes your sites from external EU vantage points with real TLS verification, the way a visitor's browser would, and correlates the outside view with the inside one. Dead outside plus healthy inside is its own incident type, and it tells you exactly that.
- External HTTP probes with certificate validation and redirect limits
- Two-eyes correlation: inside and outside latency side by side on every site
- Safety by design: internal-only names are never probed from the internet
- Jobs and heartbeats: backups, crons and queues page you when they go quiet
- Multi-step flows: scripted browser and API transactions, login to checkout, asserted step by step
- Published prober IPs and a distinct user agent, WAF-friendly by default
Search the whole fleet like one file.
The agent already knows where every log lives, because it read the configs. Collection is a toggle, not a pipeline project. Live tail streams across hosts, full-text search goes back as far as your plan's retention, and log lines sit next to the metrics and traces from the same moment, so the story reads in one place.
- Full-text search with host, service and severity filters
- Live tail across many hosts at once
- Incident context: the log window around an alert, one click away
- Retention by plan, quotas visible, overage never silent
web-01 nginx 499 POST /api/cart client closed web-02 php E_WARNING array_key_exists() in Cart.php:214 db-01 mysql Aborted connection (net_read_timeout) web-01 nginx 502 GET /checkout upstream timed out web-01 wakora incident #218 opened · site_5xx
The switch, the UPS and the printer nobody admits owning.
One agent monitors the network around the server. Any host you already monitor can act as a collector for the devices near it, with nothing installed on the devices themselves. SNMP v2c and v3 with authentication and encryption, traps for the things that will not wait for a poll, sensors, PoE budgets and per-port counters. When the UPS goes to battery, you get the incident with runtime remaining, not a mystery reboot an hour later.
- SNMP v2c and v3, traps and informs included
- Switches: port state, errors, traffic, PoE per port
- UPS: battery, load, runtime, with escalation when it matters
- Topology that draws itself: LLDP/CDP neighbors, MAC-to-port tracking, VLANs and IPAM
- NetFlow and sFlow traffic analysis, plus config backups with diffs on every change
- Honest billing: a 48-port switch is one device, never 48 sensors
Clusters without a second monitoring stack.
One DaemonSet manifest and the cluster reports in: nodes, pods, namespaces, restart storms and resource hogs, next to the rest of your fleet instead of in a separate silo. Docker hosts get per-container metrics automatically. Ephemeral workloads are grouped by service and image, so autoscaling changes your capacity, not your bill.
- DaemonSet install, one manifest, no operators to babysit
- Nodes, pods, namespaces, restarts and pending states
- Top consumers by CPU and memory at a glance
- Containers grouped by service, never billed per instance
Patch debt, visible before the auditor finds it.
Every host already reports its packages, so the fleet-wide picture of pending updates and known CVEs comes free. Add an SSH access journal and hardening checks written in plain language, and the monthly security review turns from an expedition into a filter. This will not replace your scanner. It will tell you which box the scanner will embarrass you about.
- Pending patches and CVEs across the fleet, sorted by exposure
- SSH journal: who logged in where, and when
- Hardening checks with the fix spelled out, not just a red mark
- Certificate watch: every TLS cert, every expiry date, one list
One incident. Not a storm of forty.
When a host dies, its database, its sites and its certificates all look broken at once. The incident engine deduplicates and inhibits: one root incident, everything else folded under it. Escalation chains then walk the ladder you designed: push and chat first, SMS next, and finally a phone call that speaks the incident aloud in your language and takes commands. Press 1 to acknowledge, press 2 to resolve.
Rotations are timezone-aware, with overrides and gap detection, and the system checks in the evening that tonight's on-call actually has a verified phone number. Honesty is enforced end to end: resolving an incident whose condition is still failing turns into an acknowledgement, and the timeline says so.
- Channels: push, email, Telegram, Slack, Teams, SMS, voice call with IVR
- Quiet hours that critical alerts still pierce
- Maintenance windows, so planned work never pages anyone
- Ack from anywhere: chat buttons, console, or the phone keypad
- Phone-ready console: the full product in your pocket, tab bar and all
- Console in 29 languages: every EU language plus Russian, Chinese and Arabic with full RTL
- Spend caps on voice and SMS, set by you, enforced by us
Proof, for clients and for yourself.
Public status pages run on your own domain with your branding, fed by the same data as the console, so they never disagree with reality. SLA and error-budget reports arrive on schedule, and capacity reviews point at the oversized instance you have been paying for since March. Cost honesty is a feature here too.
- Status pages on custom domains, with subscriptions and planned maintenance
- SLA and error budgets per client, exportable as PDF and CSV
- Weekly digest: what broke, what almost broke, what to do about it
- Capacity, waste and carbon: rightsizing suggestions and a fleet footprint estimate, grounded in real usage
Plays well with your stack. And with your AI.
Two-way ChatOps in Slack, Teams and Telegram, webhooks in both directions, ticketing hooks for Jira and ServiceNow, Prometheus export for the dashboards you already have, Terraform for the setup you want reviewed, and a public API underneath all of it.
There is also an MCP server, so AI agents can operate Wakora the way a colleague would: query metrics, investigate incidents, acknowledge and silence. Tenant-scoped, read-only by default, every mutation gated by scope and written to the audit log. Your AI gets hands, you keep the receipts.
- ChatOps: alerts with live buttons, not just links
- Public API and webhooks for anything we did not think of
- Bring your alerts: Alertmanager, Grafana, Zabbix and Sentry feed the same incident engine
- Prometheus export and deploy markers for release correlation
- MCP for AI agents: read-only by default, mutations audited
ai> why is checkout slow since 14:00? wakora p95 on POST /checkout rose 3.1x at 14:02, same minute as deploy v2.14.1. traces show one SELECT executed 216x per request. ai> ack incident 218, note the deploy wakora acked · noted · audit #8412 written
See it with your own fleet, not a demo dataset.
Three hosts free, forever. Discovery does the tour for you.